Implied SSH connection arguments in Ansible - ansible

Question

When running playbook given in this answer with -vvv I get the following log:
<192.168.1.109> SSH: EXEC ssh -C -q -o PasswordAuthentication=yes
-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
-o ControlMaster=auto -o ControlPersist=60s
-o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no
-o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey
-o PasswordAuthentication=no -o ConnectTimeout=120
-o ControlPath=/Users/techraf/.ansible/cp/ansible-ssh-%h-%p-%r 192.168.1.109
'/bin/sh -c '"'"'( umask 77 && mkdir -p "` echo $HOME/.ansible/tmp/ansible-tmp-1469485176.18-28678795304310 `" && echo ansible-tmp-1469485176.18-28678795304310="` echo $HOME/.ansible/tmp/ansible-tmp-1469485176.18-28678795304310 `" ) && sleep 0'"'"''
The first part of SSH arguments is taken from ansible.cfg present in the current directory (which is what I intended):
[ssh_connection]
ssh_args = -o PasswordAuthentication=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ControlMaster=auto -o ControlPersist=60s
Where does the second part:
-o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no
-o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey
-o PasswordAuthentication=no -o ConnectTimeout=120
come from?
My objective is to run this playbook using password authentication, yet the latter group of arguments prevents it.
I have checked the following are cleared/non-existent:
/usr/local/etc/ansible/ansible.cfg (I am running Homebrew-installed Ansible on OS X)
$ANSIBLE_CONFIG environment variable
.ansible.cfg (in the home directory)
I am running Ansible 2.1.0.0.

Answer 1

By the time the connection's getting set up, it doesn't think you have a password set, so it's trying to remove that from the valid negotiation options. See the source for more detail, or ensure ansible_password is set on the host in question.

Answer 2

My objective is to run this playbook using password authentication, yet the latter group of arguments prevents it.
You need to add an additional parameter for Ansible to use password authentication:
-k, --ask-pass ask for connection password
Ansible will then prompt for your password once, then use that password for connecting to all servers in that run.
You generally should avoid using password auth for ssh. Not only is it annoying (you have to type the password in all the time), but it opens up your server to brute-force attacks; even if you block those using other means (e.g. fail2ban), it's still not a great idea. If you don't like having keys authenticate without any password, you can put a password on the keys and decrypt them on boot using an ssh agent.